CVE-2024-9394 is a high-severity vulnerability in Firefox and Thunderbird where an attacker can execute arbitrary JavaScript via a specially crafted multipart response under the resource://devtools origin. This allows access to cross-origin JSON content. On desktop clients, Site Isolation limits this access to same-site documents, but on Android versions, full cross-origin access is possible. The vulnerability affects Firefox versions prior to 131, Firefox ESR versions prior to 128.3 and 115.16, and Thunderbird versions prior to 128.3 and 131. Mozilla has released fixes in Firefox 131, Firefox ESR 128.3, and Thunderbird 128.3 and 131.